{"id":3958,"date":"2026-11-05T07:10:52","date_gmt":"2026-11-05T15:10:52","guid":{"rendered":"https:\/\/cyber.mag212.com\/rails-active-storage-ghsa-f3w6-w445-fwh9-upgrade-rotate-secrets\/"},"modified":"2026-11-05T07:10:52","modified_gmt":"2026-11-05T15:10:52","slug":"rails-active-storage-ghsa-f3w6-w445-fwh9-upgrade-rotate-secrets","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/rails-active-storage-ghsa-f3w6-w445-fwh9-upgrade-rotate-secrets\/","title":{"rendered":"Rails Active Storage GHSA-f3w6-w445-fwh9\u00a0: Mettez \u00e0 niveau vers la version 8.0.5.2 ou 8.1.4.1, puis effectuez une rotation de vos secrets."},"content":{"rendered":"<p class=\"wp-block-paragraph\">Rails released <strong>8.0.5.2 and 8.1.4.1<\/strong> on November 4, fixing 21 security issues. The most serious, <strong>GHSA-f3w6-w445-fwh9<\/strong> (CVSS 9.8), lets an untrusted image upload write files on the server, and read them on apps that store files on local disk, through a permissive ImageMagick setup. For those apps, upgrading is only half the job: secrets the app could read, including <code data-no-translation=\"\">secret_key_base<\/code>, need rotating too.<\/p>\n\n<h2 class=\"wp-block-heading\">Faits cl\u00e9s<\/h2>\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Article<\/th><th>D\u00e9tail<\/th><\/tr><\/thead><tbody><tr><td>Releases<\/td><td>Rails 8.0.5.2 and 8.1.4.1, November 4, 2026<\/td><\/tr><tr><td>Port\u00e9e<\/td><td>21 advisories: 1 Critical, 4 High, 13 Medium, 3 Low; GHSA IDs only, no CVEs listed<\/td><\/tr><tr><td>Critique<\/td><td>GHSA-f3w6-w445-fwh9: Active Storage image analysis file write\/read, CVSS 9.8, no login<\/td><\/tr><tr><td>Haut<\/td><td>GHSA-v924-7rp8-4mxh: media processing via file extension, CVSS 8.8, needs an upload account<\/td><\/tr><tr><td>Affected<\/td><td>activestorage before 8.0.5.2, and 8.1 before 8.1.4.1<\/td><\/tr><tr><td>Exploitation<\/td><td>None reported in the advisories<\/td><\/tr><tr><td>Deadline<\/td><td>Rails 8.0 security support ends November 7, 2026<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">An early version of one report gave the critical flaw a CVE number. We found no such record: the advisory says &#8220;No known CVE&#8221;.<\/p>\n\n<h2 class=\"wp-block-heading\">Are you affected by the critical flaw?<\/h2>\n\n<p class=\"wp-block-paragraph\">All three must be true:<\/p>\n\n<ul class=\"wp-block-list\"><li>The app uses <code data-no-translation=\"\">:mini_magick<\/code> for image processing. That is the default under <code data-no-translation=\"\">load_defaults<\/code> 6.1 or earlier.<\/li><li>The system ImageMagick policy does not block the dangerous coders. Stock Debian and Ubuntu policies don&#8217;t.<\/li><li>Untrusted users can upload files. Simply attaching an upload is enough to trigger analysis.<\/li><\/ul>\n\n<p class=\"wp-block-paragraph\">D\u00e9poser <em>read<\/em> additionally needs the Disk storage service. That&#8217;s what makes <code data-no-translation=\"\">secret_key_base<\/code> and other secrets reachable.<\/p>\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1598\" height=\"623\" src=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-05-fig-rai.jpg\" alt=\"Diagram of two Rails Active Storage flaws through ImageMagick and media decoders, with fixes and secret rotation\" class=\"wp-image-3943\" srcset=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-05-fig-rai.jpg 1598w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-05-fig-rai-300x117.jpg 300w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-05-fig-rai-1024x399.jpg 1024w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-05-fig-rai-768x299.jpg 768w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-05-fig-rai-1536x599.jpg 1536w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-05-fig-rai-18x7.jpg 18w\" sizes=\"auto, (max-width: 1598px) 100vw, 1598px\" \/><figcaption class=\"wp-element-caption\">The two Active Storage paths and what to do after patching. MAG212 CYBER original diagram, based on the Rails advisories.<\/figcaption><\/figure>\n\n<h2 class=\"wp-block-heading\">The second flaw: a file extension that picks the decoder<\/h2>\n\n<p class=\"wp-block-paragraph\"><strong>GHSA-v924-7rp8-4mxh<\/strong> affects apps that analyze or preview video and audio. The temporary file kept the uploader&#8217;s chosen extension, which steers ffprobe, ffmpeg or ImageMagick toward a particular decoder. One code-execution route needs FFmpeg built with <code data-no-translation=\"\">--enable-avisynth<\/code> plus AviSynthPlus installed, which distribution packages usually don&#8217;t enable. The fix keeps an extension only when it matches the recorded content type.<\/p>\n\n<h2 class=\"wp-block-heading\">How to fix it properly<\/h2>\n\n<ol class=\"wp-block-list\"><li><strong>Upgrade every image<\/strong> that runs the app, web and background workers alike. Analysis often runs in workers.<\/li><li><strong>Use mini_magick 5.1 or later.<\/strong> Older versions make the fixed release raise an error at boot.<\/li><li><strong>Let Rails&#8217; policy do its job.<\/strong> The fixed release ships its own restrictive ImageMagick policy. If you render PDF or PostScript, re-allow only what you need. If you override <code data-no-translation=\"\">MiniMagick.cli_env<\/code> or use <code data-no-translation=\"\">cli_prefix<\/code>, copy the rules into the system policy yourself.<\/li><li><strong>Rotate secrets on the Disk service:<\/strong> <code data-no-translation=\"\">secret_key_base<\/code> and every secret the app process can read.<\/li><li><strong>Can&#8217;t upgrade today?<\/strong> Harden the system <code data-no-translation=\"\">policy.xml<\/code>, and remove VideoPreviewer, VideoAnalyzer and AudioAnalyzer from the config.<\/li><\/ol>\n\n<p class=\"wp-block-paragraph\">Read-only checks to run inside each deployed image, from the app root:<\/p>\n\n<pre class=\"wp-block-code\" data-no-translation=\"\"><code data-no-translation=\"\">bundle info activestorage   # expect 8.0.5.2+ or 8.1.4.1+\nbundle info mini_magick     # expect 5.1 or later\nmagick -list policy         # ImageMagick 7\nconvert -list policy        # ImageMagick 6<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\"><em>Checked against Bundler and ImageMagick documentation; not run against a live app for this article.<\/em><\/p>\n\n<h2 class=\"wp-block-heading\">Verify and plan ahead<\/h2>\n\n<ul class=\"wp-block-list\"><li>Every running image, not just the lockfile, reports the fixed versions.<\/li><li>Safe test uploads (images, video, PDF if you use it) still analyze and preview in staging.<\/li><li>Rotated secrets are live and old sessions are invalidated.<\/li><li>Plan the move off Rails 8.0 before security support ends on November 7. No 7.x release was issued; the latest 7.2 is 7.2.4 from September.<\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">Foire aux questions<\/h2>\n\n<h3 class=\"wp-block-heading\">What is the CVE for the critical Rails Active Storage flaw?<\/h3>\n\n<p class=\"wp-block-paragraph\">It has none. It is tracked as GitHub advisory GHSA-f3w6-w445-fwh9.<\/p>\n\n<h3 class=\"wp-block-heading\">Is it being exploited?<\/h3>\n\n<p class=\"wp-block-paragraph\">Neither advisory nor the release post reports exploitation. Don&#8217;t confuse it with July&#8217;s unrelated libvips issue.<\/p>\n\n<h3 class=\"wp-block-heading\">Do I need to rotate secrets if I use S3 storage?<\/h3>\n\n<p class=\"wp-block-paragraph\">The file-read part of the critical flaw requires the Disk service, so the rotation advice targets Disk-service users. Upgrade regardless.<\/p>\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\"><div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/cyber.mag212.com\/fr\/the-patch-that-didnt-hold-mag212-cyber-daily-november-5-2026\/\">Read today&#8217;s full MAG212 CYBER Daily (free) \u2192<\/a><\/div><div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/cyber.mag212.com\/fr\/subscribe-free\/\">Abonnez-vous gratuitement<\/a><\/div><\/div>\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/rubyonrails.org\/2026\/11\/4\/Rails-8.0.5.2-and-8.1.4.1-have-been-released\" target=\"_blank\" rel=\"noreferrer noopener\">Ruby on Rails: Rails 8.0.5.2 and 8.1.4.1 have been released (Nov 4)<\/a><\/li><li><a href=\"https:\/\/github.com\/rails\/rails\/security\/advisories\/GHSA-f3w6-w445-fwh9\" target=\"_blank\" rel=\"noreferrer noopener\">GHSA-f3w6-w445-fwh9: Active Storage image analysis<\/a><\/li><li><a href=\"https:\/\/github.com\/rails\/rails\/security\/advisories\/GHSA-v924-7rp8-4mxh\" target=\"_blank\" rel=\"noreferrer noopener\">GHSA-v924-7rp8-4mxh: Active Storage media processing<\/a><\/li><li><a href=\"https:\/\/rubygems.org\/gems\/activestorage\/versions\" target=\"_blank\" rel=\"noreferrer noopener\">RubyGems: activestorage versions<\/a><\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">Articles connexes sur MAG212 CYBER<\/h2>\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/cyber.mag212.com\/fr\/the-patch-that-didnt-hold-mag212-cyber-daily-november-5-2026\/\">The Patch That Didn&#8217;t Hold: MAG212 CYBER Daily, 5 November 2026<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/zyxel-gs1900-cve-2026-107441-june-patch-zero-day\/\">Zyxel GS1900 Zero-Day: Why the June Patch Didn\u2019t Hold<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/crafty-falcon-cert-in-ai-assisted-attacks-payment-firms\/\">Crafty Falcon: CERT-In Warns of AI-Assisted Attacks on Payment Firms<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/ai-developer-platform-breaches-rotate-stored-keys\/\">AI Developer Platform Breaches: Rotate the Keys You Stored<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/barracuda-esg-cve-2026-116606-cve-2026-111560-root-chain\/\">Barracuda ESG Chain: From Admin Interface to Root<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/android-cve-2026-58868-chrome-157-november-patches\/\">Android CVE-2026-58868 and Chrome 157: November\u2019s Patch Load<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/magazine-library\/\">Chaque num\u00e9ro de la biblioth\u00e8que de magazines<\/a><\/li><\/ul>","protected":false},"excerpt":{"rendered":"<p>Rails 8.0.5.2 and 8.1.4.1 fix 21 issues, including a critical Active Storage flaw that lets untrusted image uploads write and read files through ImageMagick. Here is who is affected, how to fix it properly, and when to rotate secret_key_base.<\/p>","protected":false},"author":1,"featured_media":3948,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,14],"tags":[195,196,107,194],"class_list":["post-3958","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-critical-cves","category-vulnerabilities","tag-active-storage","tag-imagemagick","tag-patch-management","tag-ruby-on-rails"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3958"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3958\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3948"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}